File GraphicsMagick-CVE-2017-16353.patch of Package GraphicsMagick.8649

Overview Repositories Revisions Requests Users Attributes Meta

File GraphicsMagick-CVE-2017-16353.patch of Package GraphicsMagick.8649

--- a/magick/describe.c	Sun Oct 22 11:41:14 2017 -0500
+++ b/magick/describe.c	Sun Oct 22 13:30:17 2017 -0500
@@ -657,7 +657,7 @@
       */
       (void) fprintf(file,"  Profile-iptc: %lu bytes\n",(unsigned long)
                      profile_length);
-      for (i=0; i < profile_length; )
+      for (i=0; i+5U < profile_length; )
         {
           if (profile[i] != 0x1c)
             {
@@ -685,7 +685,7 @@
             case 60: tag=(char *) "Created Time"; break;
             case 65: tag=(char *) "Originating Program"; break;
             case 70: tag=(char *) "Program Version"; break;
-            case 75: tag=(char *) "Object Cycle"; break;
+            case 75: tag=(char *) "Object Cyc"; break;
             case 80: tag=(char *) "Byline"; break;
             case 85: tag=(char *) "Byline Title"; break;
             case 90: tag=(char *) "City"; break;
@@ -726,6 +726,7 @@
           (void) fprintf(file,"    %.1024s:\n",tag);
           length=profile[i++] << 8;
           length|=profile[i++];
+          length=Min(length,profile_length-i);
           text=MagickAllocateMemory(char *,length+1);
           if (text != (char *) NULL)
             {

Places

File GraphicsMagick-CVE-2017-16353.patch of Package GraphicsMagick.8649

Places